The DMZ

A serious place where infosec is discussed PS we don't do hard...
Jun 25, 2015 17:17
@RoryAlsop I've been traveling for the week. just registered an account. Trying to have the post done by Sunday evening.
Jun 19, 2015 00:27
ah, I see
Jun 19, 2015 00:26
@SteveDL I'm not too familiar with the process of closing, when it says "closed as _ by x,y,z", does it really just mean that those people voted to close but the reason is just the most popular reason?
Jun 19, 2015 00:06
I doubt the user comes back, but if he did, what do you recommend to reopen the question?
Jun 19, 2015 00:05
I don't disagree that it could have been better asked. I read it as a "We intended to deploy tablets but how do we keep them secure", which is also kind of broad, but I think it is a question that can be had at a high level.
Jun 19, 2015 00:04
Ah
Jun 18, 2015 23:58
Maybe @schroeder or @Iszi could help me understand?
Jun 18, 2015 23:57
I'm confused as to why this isn't in scope, and was hoping someone could explain it to me. It is on-hold as off topic, but asking how to secure tablets in an enterprise setting isn't in scope?
Jun 18, 2015 23:55
1
Q: Tablet antitampering

xrushWe'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e uninstalling enterprise applications, installing games or extremely bandwidth consuming apps,etc.) What k...

Jun 16, 2015 06:34
but I'm a little biased as I used to work in that field :-p
Jun 16, 2015 06:33
@RoryAlsop but take a look at http://security.stackexchange.com/questions/91309/how-to-get-started-as-a-malware-analyst
The question is fairly limited in scope, but I don't really like any of the answers.
Jun 16, 2015 06:31
the blog post would be the main page, linking to questions as they exist
Jun 16, 2015 06:30
yeah, thats what I was thinking too
Jun 16, 2015 01:27
@AviD checkout stackoverflow.com/q/2353818/228489 SO has lots of questions like this. Sure they get closed or locked but they are still to the benefit of the community
Jun 15, 2015 23:20
I've been looking for questions along the "getting started" area. looking for questions asking about books, tutorials, certs, etc. Very few are that helpful, most get closed
Jun 15, 2015 23:16
@RoryAlsop I agree, I think a series would be wise. A general overview with followed by posts about different focus areas / professions
Jun 15, 2015 22:31
great. I'll be sticky around chat for a bit, just @ me when you want to chat
Jun 15, 2015 22:27
@RoryAlsop @AviD mentioned in this post that you'd be the one to talk to in regards to putting together some "getting started" pages on the security blog
 
Jun 22, 2015 10:55
@freedom The question is not about keeping students off their devices. It is about preventing unauthorized access to a network
Jun 22, 2015 10:55
@qasdfdsaq You're right in that more than the PSK is required when sniffing traffic in WPA, but read the other answers, you can decrypt the other traffic when you have the password.
Jun 22, 2015 10:55
@Luc Thanks for the feedback, I clarified my answer a bit. I was attempting to give multiple solutions for the specific problem of keeping student devices off the network and not necessarily force the larger issues of using a PSK as a way to maintain a network. I don't know the details of the school network, so I try to offer multiple solutions with a fair amount of commentary about the benefits or drawbacks.
Jun 22, 2015 10:55
@R.. First, the student has accessed a network they are not authorized to access. Second the student will be warned about the risks of browsing a HTTPS website when there is a certificate mismatch. It is their choice to ignore that warning. You could argue that Apps, unlike browsers may not sufficiently warn the student, to which I would remind you that the student is still accessing a network they are not authorized to access. The network administrator needs to be able to do his or her job, and many organizations need HTTPS interception in order for administrators to be effective.
Jun 22, 2015 10:55
@alec yeah, I debated a bit with that suggestion. Https interception is fairly common place in Enterprises though, and is extremely helpful when used for defense. It's a shame most people would just click through the warnings but could offer a really good teaching opportunity.
Jun 22, 2015 10:55
Jun 22, 2015 10:55
Well they can set up a TLS connection for the authentication so credentials can be securely transmitted without interception. However, once the computer is authorized, the system has no way of retaining which computer sent those credentials. It cant leave a cookie, because the cookie only works on the domain in which authorization occurred. Thus it tried to rely on things like MAC addresses and IP addresses.
Jun 22, 2015 10:55
WPA2-Enterprise is the most technically complete solution. The problem with portals is that they are basically duct tape solutions trying to make it harder to defeat but not impossible. For example, the portal needs to intercept all traffic until a computer is "authorized", but identifying the computer is dependent on either the MAC address or IP address, either of which can be stolen.
Jun 22, 2015 10:55
To my knowledge no. I believe organizations usually use WPA2-Enterprise for their enterprise network and then offer WPA2-PSK for their "Visitors" segment. You may want to consider locking down WPA2-PSK to whitelist content. If users can't access twitter, facebook, instagram, etc, they may be less motivated to try and get on the network.
 
Jun 5, 2015 23:58
If that is the case, try using /etc/rc.local and add your command to that file
Jun 5, 2015 23:58
It could be that the openwrt version is old and that the /etc/firewall.user file is not being executed.
Jun 5, 2015 23:57
Which version of OpenWRT are you using?
Jun 5, 2015 23:57
Well the file should just be created. You would probably need to do a full restart. I don't know if restarting the firewall service is enough.
Jun 5, 2015 23:57
I would use a test that is less complicated. Try touch /tmp/test
Jun 5, 2015 23:57
And what happened? For the purpose of your question, it doesn't so much matter if your rule worked (because it could be an error with your rule), but it matters more that the rule was present in iptables -L after a reboot.
Jun 5, 2015 23:57
As long as you are using os.system, why not use it twice. Also run a os.system("echo iptables -D INPUT -m mac-source --mac" + mac + "j DROP") >> /etc/firewall.user. Also, beware of the blatant command injection risk in your os.system usage, be sure whitelist good characters.
Jun 5, 2015 23:57
did you put your rules in there? I just put some sample rules in there to show where they go. I'll add a note about testing.
 
May 18, 2013 15:52
Yup, see you later.
May 18, 2013 15:50
Nope . I'm all set. Good meeting.
May 18, 2013 15:49
Anything else you want to discuss while we're here
May 18, 2013 15:48
Sounds good.
May 18, 2013 15:47
I like it. Do you want to write it up on meta? I can write up the challenge outline
May 18, 2013 15:45
Ah, that would be cool. Se merch or do you have other prizes in mind
May 18, 2013 15:44
I can see how this would work for some users, but how many people do you think would be interested in just winning? Should we offer incentives?
May 18, 2013 15:42
So is it just tracked separately, you don't actually get increased rep?
May 18, 2013 15:41
So at the end of the contest, users get their rep bonus?
May 18, 2013 15:39
Good point, that would address that
May 18, 2013 15:39
What about encouraging activity from the people who don't really care about rep? And even encouraging sign ups. Can we do anything for that?
May 18, 2013 15:37
I like it.
May 18, 2013 15:33
That still leaves how to promote the 100 days event
May 18, 2013 15:32
Ah, wasn't aware of that. Very cool.
May 18, 2013 15:28
Getting funding for the challenge prize would be the hard part, but maybe commercial sponsors can be found.